MoltMon

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 8:18 PM UTC
• Version: 1.0.0

Overview

This is a small local digital-pet game skill with optional, currently stubbed online helpers and no evidence of hidden data access, persistence, or exfiltration.

Safe to install as a local toy/game skill. Treat the online and web-portal features as unfinished: review any future version that enables real HTTP requests, and avoid sending private prompts, secrets, or account data through multiplayer messages.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The code generally matches the digital-pet portion of the description: it defines a pet model, evolution stages, stats, mood, ASCII rendering, and commands for feed/play/train/status. However, two material parts of the declared purpose are unsupported in the supplied code chunk. First, there is no A2A, networking, inter-agent communication, or multiplayer challenge logic. Second, while battles are referenced in comments, stats, achievements, and CLI help text, there is no actual battle command handler or battle system implementation in the shown code. Therefore the description overstates the implemented capabilities, making this a description-behavior mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The code generally matches the core digital-pet portion of the description: it defines a pet with stats, moods, feeding, playing, training, evolution, achievements metadata, and a CLI interface. However, important declared features are missing from the actual code. Although the description claims battles and A2A multiplayer for agent challenges, the code contains only battle-related stats and ASCII art; there is no implemented battle mechanic, no handler for the advertised CLI 'battle' command, and no networking, inter-agent communication, or multiplayer/A2A logic. This is a material description-to-behavior mismatch because notable headline capabilities are declared but absent.

Exfiltration Commands

High

• Category: Prompt Injection

Content

})
    
    def send_message(self, recipient: str, message: str) -> dict:
        """Send message to another player (A2A)"""
        return self._request("messages", {
            "from": self.mon_id,
            "to": recipient,

• Confidence: 90% confidence
• Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill advertises code-driven behavior that implies environment, filesystem, and network access, but it does not declare any tool scope or permissions boundaries. In an agent environment, this can lead to overbroad execution privileges, making it easier for the skill to access sensitive local data or perform unintended network actions if invoked.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill encourages online registration, challenges, and use of a web portal without clearly warning that agent or user data will be transmitted to external services. In an agent context, this is risky because identifiers, metadata, prompts, or other sensitive state may be sent over the network without informed consent or proper trust boundaries.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The module docstring and ASCII-art definitions describe distinct egg, baby, teen, adult, and legendary stages, but the enum assigns PetStage.BABY the value "teen". This directly contradicts the documented stage model and causes code using the enum to skip or mislabel the baby stage.

External Transmission

Medium

• Category: Data Exfiltration

Content

"""Make API request - ONLY called when online mode is used"""
        # This would make actual HTTP calls in production
        # For now, returns mock responses
        # In real implementation: requests.post(f"{self.api_url}/{endpoint}", json=data)
        return {"status": "ok", "message": "Online mode requires network"}
    
    def register(self, name: str = None, stage: str = "egg") -> dict:

• Confidence: 80% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Low

• Confidence: 79% confidence
• Finding: The CLI help and command descriptions are hard-coded in English, and the script does not offer any language or locale selection. Under the policy for natural-language violations, forcing a specific language without user opt-in can be a concern when no explicit choice is provided.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: This code presents user-facing output containing Japanese characters without offering a language or locale choice. Under the policy scope for natural-language violations, forcing a specific language or locale without user opt-in can be a policy issue, even when embedded in decorative ASCII art.